Analysis Report case (4335).xls

Overview

General Information

Sample Name:	case (4335).xls
Analysis ID:	344665
MD5:	bf86559630b855e4bf2c54d641147b24
SHA1:	182cbac1bdd020fa5fee6ed9d6a50d1071fbe320
SHA256:	31ea3370ca06a2af45514a59a0ae49dc62ac34bc4dce44402f169a9d6fb93853
Tags:	xls
Most interesting Screenshot:

Detection

Hidden Macro 4.0

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Document exploit detected (creates forbidden files)

Document exploit detected (drops PE files)

Found malicious Excel 4.0 Macro

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Contains functionality to inject code into remote processes

Document exploit detected (UrlDownloadToFile)

Document exploit detected (process start blacklist hit)

Found Excel 4.0 Macro with suspicious formulas

Found abnormal large hidden Excel 4.0 Macro sheet

Found malicious URLs in unpacked macro 4.0 sheet

Found obfuscated Excel 4.0 Macro

Office process drops PE file

Sigma detected: Microsoft Office Product Spawning Windows Shell

Yara detected hidden Macro 4.0 in Excel

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Antivirus or Machine Learning detection for unpacked file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the product ID of Windows

Uses code obfuscation techniques (call, push, ret)

Classification

Signatures

AV Detection:

Antivirus or Machine Learning detection for unpacked file

Source: 4.2.rundll32.exe.340000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen2
Source: 5.2.msiexec.exe.d0000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen2

Compliance:

Uses new MSVCR Dlls

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 172.67.150.228:443 -> 192.168.2.22:49165 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.200.147:443 -> 192.168.2.22:49166 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.169:443 -> 192.168.2.22:49167 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.73.69:443 -> 192.168.2.22:49168 version: TLS 1.2

Binary contains paths to debug symbols

Source:

Binary string: c:\PlanetAllow\OpenRoll\cellNumeral\money.pdb source: scfrd[1].dll.0.dr

Software Vulnerabilities:

Document exploit detected (creates forbidden files)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\scfrd[1].dll			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\ProgramData\formnet.dll			Jump to behavior

Document exploit detected (drops PE files)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: scfrd[1].dll.0.dr

Jump to dropped file

Document exploit detected (UrlDownloadToFile)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA

Jump to behavior

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\rundll32.exe

Jump to behavior

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then push 0000000Ah	4_2_0034D830
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then mov eax, dword ptr [edi-08h]	4_2_00358830
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then push 00000000h	4_2_0035DA70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then add esi, 02h	4_2_0035CE40
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then push 0000000Ah	5_2_000DD830
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then mov eax, dword ptr [edi-08h]	5_2_000E8830
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then add esi, 02h	5_2_000ECE40
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then push 00000000h	5_2_000EDA70

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: rnollg.com

Potential document exploit detected (performs HTTP gets)

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 172.67.150.228:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 172.67.150.228:443

Networking:

Found malicious URLs in unpacked macro 4.0 sheet

Source: before.1.0.0.sheet.csv_unpack

Macro 4.0 Deobfuscator: https://rnollg.com/kev/scfrd.dll

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: C:\Windows\SysWOW64\msiexec.exe

Code function: 5_2_000D1AF0 InternetReadFile,

5_2_000D1AF0

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ

Jump to behavior

Source: msiexec.exe, 00000005.00000002.2356048675.000000000048D000.00000004.00000020.sdmp	String found in binary or memory: /moc.nideknil.wwwwww.linkedin.com equals www.linkedin.com (Linkedin)
Source: rundll32.exe, 00000003.00000002.2155870146.0000000001B50000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2154867305.0000000001DD0000.00000002.00000001.sdmp	String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: msiexec.exe, 00000005.00000002.2356048675.000000000048D000.00000004.00000020.sdmp	String found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: unknown

DNS traffic detected: queries for: rnollg.com

Source: msiexec.exe, 00000005.00000002.2356064287.00000000004C2000.00000004.00000020.sdmp	String found in binary or memory: http://cacerts.digicert.com/CloudflareIncECCCA-3.crt0
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: msiexec.exe, 00000005.00000002.2356064287.00000000004C2000.00000004.00000020.sdmp	String found in binary or memory: http://crl3.digicert.com/CloudflareIncECCCA-3.crl07
Source: msiexec.exe, 00000005.00000002.2356064287.00000000004C2000.00000004.00000020.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0m
Source: msiexec.exe, 00000005.00000002.2356064287.00000000004C2000.00000004.00000020.sdmp	String found in binary or memory: http://crl4.digicert.com/CloudflareIncECCCA-3.crl0
Source: msiexec.exe, 00000005.00000002.2356064287.00000000004C2000.00000004.00000020.sdmp	String found in binary or memory: http://crl4.digicert.com/CloudflareIncECCCA-3.crl0K
Source: rundll32.exe, 00000003.00000002.2155870146.0000000001B50000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2154867305.0000000001DD0000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com
Source: rundll32.exe, 00000003.00000002.2155870146.0000000001B50000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2154867305.0000000001DD0000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com/
Source: rundll32.exe, 00000003.00000002.2157152768.0000000001D37000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2155127079.0000000001FB7000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: rundll32.exe, 00000003.00000002.2157152768.0000000001D37000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2155127079.0000000001FB7000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: msiexec.exe, 00000005.00000002.2356064287.00000000004C2000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: msiexec.exe, 00000005.00000002.2356064287.00000000004C2000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: msiexec.exe, 00000005.00000002.2356240442.0000000002060000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: rundll32.exe, 00000003.00000002.2157152768.0000000001D37000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2155127079.0000000001FB7000.00000002.00000001.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: rundll32.exe, 00000003.00000002.2157152768.0000000001D37000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2155127079.0000000001FB7000.00000002.00000001.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: 0FDE0000.0.dr	String found in binary or memory: http://wmwifbajxxbcxmucxmlc.com/files/april24.dll)
Source: case (4335).xls	String found in binary or memory: http://wmwifbajxxbcxmucxmlc.com/files/april24.dll~
Source: msiexec.exe, 00000005.00000002.2356240442.0000000002060000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: msiexec.exe, 00000005.00000002.2356064287.00000000004C2000.00000004.00000020.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: msiexec.exe, 00000005.00000002.2356064287.00000000004C2000.00000004.00000020.sdmp	String found in binary or memory: http://www.digicert.com/CPS0v
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: rundll32.exe, 00000003.00000002.2155870146.0000000001B50000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2154867305.0000000001DD0000.00000002.00000001.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: rundll32.exe, 00000003.00000002.2157152768.0000000001D37000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2155127079.0000000001FB7000.00000002.00000001.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: rundll32.exe, 00000003.00000002.2155870146.0000000001B50000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2154867305.0000000001DD0000.00000002.00000001.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: rundll32.exe, 00000004.00000002.2154867305.0000000001DD0000.00000002.00000001.sdmp	String found in binary or memory: http://www.windows.com/pctv.
Source: msiexec.exe, 00000005.00000002.2356048675.000000000048D000.00000004.00000020.sdmp	String found in binary or memory: https://gadgetswolf.com/
Source: msiexec.exe, 00000005.00000002.2356048675.000000000048D000.00000004.00000020.sdmp	String found in binary or memory: https://gadgetswolf.com/f
Source: msiexec.exe, 00000005.00000002.2356048675.000000000048D000.00000004.00000020.sdmp	String found in binary or memory: https://gadgetswolf.com/post.phpMb
Source: msiexec.exe, 00000005.00000002.2356048675.000000000048D000.00000004.00000020.sdmp	String found in binary or memory: https://gadgetswolf.com/post.phpab
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: https://govemedico.tk/post.php
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: https://homesoapmolds.com/
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
Source: before.1.0.0.sheet.csv_unpack	String found in binary or memory: https://rnollg.com/kev/scfrd.dll
Source: case (4335).xls, 0FDE0000.0.dr	String found in binary or memory: https://rnollg.com/kev/scfrd.dll$8
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: msiexec.exe, 00000005.00000002.2356064287.00000000004C2000.00000004.00000020.sdmp	String found in binary or memory: https://www.digicert.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown	Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown	Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49166 -> 443

Source: unknown	HTTPS traffic detected: 172.67.150.228:443 -> 192.168.2.22:49165 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.200.147:443 -> 192.168.2.22:49166 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.169:443 -> 192.168.2.22:49167 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.73.69:443 -> 192.168.2.22:49168 version: TLS 1.2

System Summary:

Found malicious Excel 4.0 Macro

Source: case (4335).xls

Initial sample: URLDownloadToFileA

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4	Screenshot OCR: Enable content on the yellow bar to run plugin Core decryption. 9 10 11 12 13 14 15 16 17
Source: Screenshot number: 8	Screenshot OCR: Enable Content X I J10 - "," jR V A B C D E F G H I J K L M N O P Q R S L=j 301 302 303 304

Found Excel 4.0 Macro with suspicious formulas

Source: case (4335).xls	Initial sample: CALL
Source: case (4335).xls	Initial sample: CALL

Found abnormal large hidden Excel 4.0 Macro sheet

Source: case (4335).xls

Initial sample: Sheet size: 503434

Found obfuscated Excel 4.0 Macro

Source: case (4335).xls

Initial sample: High usage of CHAR() function: 147

Office process drops PE file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\scfrd[1].dll			Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\ProgramData\formnet.dll			Jump to dropped file

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior

Detected potential crypto function

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00349C60	4_2_00349C60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00343A30	4_2_00343A30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0035DA70	4_2_0035DA70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00349A60	4_2_00349A60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00355BF0	4_2_00355BF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0040D806	4_2_0040D806
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0040F8FD	4_2_0040F8FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0040D2C4	4_2_0040D2C4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0040BB6E	4_2_0040BB6E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0040DD48	4_2_0040DD48
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_000D9C60	5_2_000D9C60
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_000D3A30	5_2_000D3A30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_000D9A60	5_2_000D9A60
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_000EDA70	5_2_000EDA70
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_000E5BF0	5_2_000E5BF0

Dropped file seen in connection with other malware

Source: Joe Sandbox View	Dropped File: C:\ProgramData\formnet.dll 0BF22B8F9AAEF21AFE71FCBBEA62325E7582DAD410B0A537F38A9EB8E6855890
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\scfrd[1].dll 0BF22B8F9AAEF21AFE71FCBBEA62325E7582DAD410B0A537F38A9EB8E6855890

Source: way.dll.5.dr

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: rundll32.exe, 00000003.00000002.2155870146.0000000001B50000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2154867305.0000000001DD0000.00000002.00000001.sdmp

Binary or memory string: .VBPud<_

Source: classification engine

Classification label: mal100.expl.evad.winXLS@7/12@4/4

Source: C:\Windows\SysWOW64\msiexec.exe

Code function: 5_2_000E9C90 AdjustTokenPrivileges,

5_2_000E9C90

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_003569A0 CreateToolhelp32Snapshot,GetCurrentProcessId,Thread32First,GetLastError,Thread32Next,

4_2_003569A0

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\0FDE0000

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\{6564EBFF-51EC-A92E-3E66-73D0C2BEFC46}
Source: C:\Windows\SysWOW64\msiexec.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\{451CDBFF-61EC-8956-3E66-73D0C2BEFC46}
Source: C:\Windows\SysWOW64\msiexec.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\{F5F5D963-6370-39BF-3E66-73D0C2BEFC46}

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRD171.tmp

Jump to behavior

Source: case (4335).xls

OLE indicator, Workbook stream: true

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\formnet.dll,DllRegisterServer

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: unknown	Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\formnet.dll,DllRegisterServer
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\formnet.dll,DllRegisterServer
Source: unknown	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec.exe
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\formnet.dll,DllRegisterServer	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\formnet.dll,DllRegisterServer	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec.exe	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:

Binary string: c:\PlanetAllow\OpenRoll\cellNumeral\money.pdb source: scfrd[1].dll.0.dr

Source: case (4335).xls

Initial sample: OLE summary lastprinted = 2021-01-26 16:17:13

Source: case (4335).xls

Initial sample: OLE indicators vbamacros = False

Data Obfuscation:

Contains functionality to dynamically determine API calls

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_0034D830 LoadLibraryA,GetProcAddress,

4_2_0034D830

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0036D1F2 push dword ptr [ecx]; iretd	4_2_0036D1F9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0036E9FA push esi; retf	4_2_0036EABE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0036EA51 push esi; retf	4_2_0036EABE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00369A5D push ebp; iretd	4_2_00369AEF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003682EB push eax; ret	4_2_0036834A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004093ED push ecx; ret	4_2_00409400
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0036B56F push esp; ret	4_2_0036B581
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0036B700 push ss; ret	4_2_0036B735
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00422B73 push esi; ret	4_2_00422B75

Persistence and Installation Behavior:

Drops PE files

Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Ubc\way.dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\scfrd[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\ProgramData\formnet.dll	Jump to dropped file

Drops PE files to the application program directory (C:\ProgramData)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\ProgramData\formnet.dll

Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_003569A0 CreateToolhelp32Snapshot,GetCurrentProcessId,Thread32First,GetLastError,Thread32Next,

4_2_003569A0

Found dropped PE file which has not been started or loaded

Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Ubc\way.dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\scfrd[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\ProgramData\formnet.dll	Jump to dropped file

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\SysWOW64\msiexec.exe TID: 2864

Thread sleep time: -240000s >= -30000s

Jump to behavior

Anti Debugging:

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_0040A0CC _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

4_2_0040A0CC

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_003569A0 CreateToolhelp32Snapshot,GetCurrentProcessId,Thread32First,GetLastError,Thread32Next,

4_2_003569A0

Contains functionality to dynamically determine API calls

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_0034D830 LoadLibraryA,GetProcAddress,

4_2_0034D830

Contains functionality to read the PEB

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00352EF0 mov eax, dword ptr fs:[00000030h]	4_2_00352EF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00420D28 mov eax, dword ptr fs:[00000030h]	4_2_00420D28
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00420C5E mov eax, dword ptr fs:[00000030h]	4_2_00420C5E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00420865 push dword ptr fs:[00000030h]	4_2_00420865
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_000E2EF0 mov eax, dword ptr fs:[00000030h]	5_2_000E2EF0

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0040A0CC _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		4_2_0040A0CC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0040ABA4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		4_2_0040ABA4

HIPS / PFW / Operating System Protection Evasion:

Contains functionality to inject code into remote processes

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_0034AE40 CreateProcessA,VirtualAllocEx,WriteProcessMemory,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,SetThreadContext,VirtualProtectEx,ResumeThread,ExitProcess,

4_2_0034AE40

Yara detected hidden Macro 4.0 in Excel

Source: Yara match

File source: case (4335).xls, type: SAMPLE

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\formnet.dll,DllRegisterServer			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec.exe			Jump to behavior

Source: msiexec.exe, 00000005.00000002.2356165032.0000000000A30000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: msiexec.exe, 00000005.00000002.2356165032.0000000000A30000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: msiexec.exe, 00000005.00000002.2356165032.0000000000A30000.00000002.00000001.sdmp	Binary or memory string: !Progman

Language, Device and Operating System Detection:

Contains functionality to query CPU information (cpuid)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_0040968A cpuid

4_2_0040968A

Contains functionality to query locales information (e.g. system language)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: GetLocaleInfoA,

4_2_0040F6BB

Queries the product ID of Windows

Source: C:\Windows\SysWOW64\msiexec.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_004095A6 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

4_2_004095A6

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_00341A00 CreateDialogParamW,GetVersion,

4_2_00341A00

Source: C:\Windows\SysWOW64\msiexec.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.150.228	unknown	United States	13335	CLOUDFLARENETUS	false
104.21.60.169	unknown	United States	13335	CLOUDFLARENETUS	false
172.67.200.147	unknown	United States	13335	CLOUDFLARENETUS	false
104.21.73.69	unknown	United States	13335	CLOUDFLARENETUS	false

Contacted Domains

Name	IP	Active
homesoapmolds.com	104.21.60.169	true
rnollg.com	172.67.150.228	true
gadgetswolf.com	172.67.200.147	true
govemedico.tk	104.21.73.69	true

AV Detection:

Antivirus or Machine Learning detection for unpacked file

Source: 4.2.rundll32.exe.340000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen2
Source: 5.2.msiexec.exe.d0000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen2

Compliance:

Uses new MSVCR Dlls

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 172.67.150.228:443 -> 192.168.2.22:49165 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.200.147:443 -> 192.168.2.22:49166 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.169:443 -> 192.168.2.22:49167 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.73.69:443 -> 192.168.2.22:49168 version: TLS 1.2

Binary contains paths to debug symbols

Source:

Binary string: c:\PlanetAllow\OpenRoll\cellNumeral\money.pdb source: scfrd[1].dll.0.dr

Software Vulnerabilities:

Document exploit detected (creates forbidden files)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\scfrd[1].dll			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\ProgramData\formnet.dll			Jump to behavior

Document exploit detected (drops PE files)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: scfrd[1].dll.0.dr

Jump to dropped file

Document exploit detected (UrlDownloadToFile)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA

Jump to behavior

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\rundll32.exe

Jump to behavior

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then push 0000000Ah	4_2_0034D830
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then mov eax, dword ptr [edi-08h]	4_2_00358830
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then push 00000000h	4_2_0035DA70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then add esi, 02h	4_2_0035CE40
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then push 0000000Ah	5_2_000DD830
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then mov eax, dword ptr [edi-08h]	5_2_000E8830
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then add esi, 02h	5_2_000ECE40
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then push 00000000h	5_2_000EDA70

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: rnollg.com

Potential document exploit detected (performs HTTP gets)

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 172.67.150.228:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 172.67.150.228:443

Networking:

Found malicious URLs in unpacked macro 4.0 sheet

Source: before.1.0.0.sheet.csv_unpack

Macro 4.0 Deobfuscator: https://rnollg.com/kev/scfrd.dll

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: C:\Windows\SysWOW64\msiexec.exe

Code function: 5_2_000D1AF0 InternetReadFile,

5_2_000D1AF0

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ

Jump to behavior

Source: msiexec.exe, 00000005.00000002.2356048675.000000000048D000.00000004.00000020.sdmp	String found in binary or memory: /moc.nideknil.wwwwww.linkedin.com equals www.linkedin.com (Linkedin)
Source: rundll32.exe, 00000003.00000002.2155870146.0000000001B50000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2154867305.0000000001DD0000.00000002.00000001.sdmp	String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: msiexec.exe, 00000005.00000002.2356048675.000000000048D000.00000004.00000020.sdmp	String found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: unknown

DNS traffic detected: queries for: rnollg.com

Source: msiexec.exe, 00000005.00000002.2356064287.00000000004C2000.00000004.00000020.sdmp	String found in binary or memory: http://cacerts.digicert.com/CloudflareIncECCCA-3.crt0
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: msiexec.exe, 00000005.00000002.2356064287.00000000004C2000.00000004.00000020.sdmp	String found in binary or memory: http://crl3.digicert.com/CloudflareIncECCCA-3.crl07
Source: msiexec.exe, 00000005.00000002.2356064287.00000000004C2000.00000004.00000020.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0m
Source: msiexec.exe, 00000005.00000002.2356064287.00000000004C2000.00000004.00000020.sdmp	String found in binary or memory: http://crl4.digicert.com/CloudflareIncECCCA-3.crl0
Source: msiexec.exe, 00000005.00000002.2356064287.00000000004C2000.00000004.00000020.sdmp	String found in binary or memory: http://crl4.digicert.com/CloudflareIncECCCA-3.crl0K
Source: rundll32.exe, 00000003.00000002.2155870146.0000000001B50000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2154867305.0000000001DD0000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com
Source: rundll32.exe, 00000003.00000002.2155870146.0000000001B50000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2154867305.0000000001DD0000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com/
Source: rundll32.exe, 00000003.00000002.2157152768.0000000001D37000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2155127079.0000000001FB7000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: rundll32.exe, 00000003.00000002.2157152768.0000000001D37000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2155127079.0000000001FB7000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: msiexec.exe, 00000005.00000002.2356064287.00000000004C2000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: msiexec.exe, 00000005.00000002.2356064287.00000000004C2000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: msiexec.exe, 00000005.00000002.2356240442.0000000002060000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: rundll32.exe, 00000003.00000002.2157152768.0000000001D37000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2155127079.0000000001FB7000.00000002.00000001.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: rundll32.exe, 00000003.00000002.2157152768.0000000001D37000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2155127079.0000000001FB7000.00000002.00000001.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: 0FDE0000.0.dr	String found in binary or memory: http://wmwifbajxxbcxmucxmlc.com/files/april24.dll)
Source: case (4335).xls	String found in binary or memory: http://wmwifbajxxbcxmucxmlc.com/files/april24.dll~
Source: msiexec.exe, 00000005.00000002.2356240442.0000000002060000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: msiexec.exe, 00000005.00000002.2356064287.00000000004C2000.00000004.00000020.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: msiexec.exe, 00000005.00000002.2356064287.00000000004C2000.00000004.00000020.sdmp	String found in binary or memory: http://www.digicert.com/CPS0v
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: rundll32.exe, 00000003.00000002.2155870146.0000000001B50000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2154867305.0000000001DD0000.00000002.00000001.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: rundll32.exe, 00000003.00000002.2157152768.0000000001D37000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2155127079.0000000001FB7000.00000002.00000001.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: rundll32.exe, 00000003.00000002.2155870146.0000000001B50000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2154867305.0000000001DD0000.00000002.00000001.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: rundll32.exe, 00000004.00000002.2154867305.0000000001DD0000.00000002.00000001.sdmp	String found in binary or memory: http://www.windows.com/pctv.
Source: msiexec.exe, 00000005.00000002.2356048675.000000000048D000.00000004.00000020.sdmp	String found in binary or memory: https://gadgetswolf.com/
Source: msiexec.exe, 00000005.00000002.2356048675.000000000048D000.00000004.00000020.sdmp	String found in binary or memory: https://gadgetswolf.com/f
Source: msiexec.exe, 00000005.00000002.2356048675.000000000048D000.00000004.00000020.sdmp	String found in binary or memory: https://gadgetswolf.com/post.phpMb
Source: msiexec.exe, 00000005.00000002.2356048675.000000000048D000.00000004.00000020.sdmp	String found in binary or memory: https://gadgetswolf.com/post.phpab
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: https://govemedico.tk/post.php
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: https://homesoapmolds.com/
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
Source: before.1.0.0.sheet.csv_unpack	String found in binary or memory: https://rnollg.com/kev/scfrd.dll
Source: case (4335).xls, 0FDE0000.0.dr	String found in binary or memory: https://rnollg.com/kev/scfrd.dll$8
Source: msiexec.exe, 00000005.00000002.2356072686.00000000004F0000.00000004.00000020.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: msiexec.exe, 00000005.00000002.2356064287.00000000004C2000.00000004.00000020.sdmp	String found in binary or memory: https://www.digicert.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown	Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown	Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49166 -> 443

Source: unknown	HTTPS traffic detected: 172.67.150.228:443 -> 192.168.2.22:49165 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.200.147:443 -> 192.168.2.22:49166 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.169:443 -> 192.168.2.22:49167 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.73.69:443 -> 192.168.2.22:49168 version: TLS 1.2

System Summary:

Found malicious Excel 4.0 Macro

Source: case (4335).xls

Initial sample: URLDownloadToFileA

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4	Screenshot OCR: Enable content on the yellow bar to run plugin Core decryption. 9 10 11 12 13 14 15 16 17
Source: Screenshot number: 8	Screenshot OCR: Enable Content X I J10 - "," jR V A B C D E F G H I J K L M N O P Q R S L=j 301 302 303 304

Found Excel 4.0 Macro with suspicious formulas

Source: case (4335).xls	Initial sample: CALL
Source: case (4335).xls	Initial sample: CALL

Found abnormal large hidden Excel 4.0 Macro sheet

Source: case (4335).xls

Initial sample: Sheet size: 503434

Found obfuscated Excel 4.0 Macro

Source: case (4335).xls

Initial sample: High usage of CHAR() function: 147

Office process drops PE file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\scfrd[1].dll			Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\ProgramData\formnet.dll			Jump to dropped file

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior

Detected potential crypto function

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00349C60	4_2_00349C60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00343A30	4_2_00343A30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0035DA70	4_2_0035DA70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00349A60	4_2_00349A60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00355BF0	4_2_00355BF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0040D806	4_2_0040D806
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0040F8FD	4_2_0040F8FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0040D2C4	4_2_0040D2C4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0040BB6E	4_2_0040BB6E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0040DD48	4_2_0040DD48
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_000D9C60	5_2_000D9C60
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_000D3A30	5_2_000D3A30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_000D9A60	5_2_000D9A60
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_000EDA70	5_2_000EDA70
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_000E5BF0	5_2_000E5BF0

Dropped file seen in connection with other malware

Source: Joe Sandbox View	Dropped File: C:\ProgramData\formnet.dll 0BF22B8F9AAEF21AFE71FCBBEA62325E7582DAD410B0A537F38A9EB8E6855890
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\scfrd[1].dll 0BF22B8F9AAEF21AFE71FCBBEA62325E7582DAD410B0A537F38A9EB8E6855890

Source: way.dll.5.dr

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: rundll32.exe, 00000003.00000002.2155870146.0000000001B50000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2154867305.0000000001DD0000.00000002.00000001.sdmp

Binary or memory string: .VBPud<_

Source: classification engine

Classification label: mal100.expl.evad.winXLS@7/12@4/4

Source: C:\Windows\SysWOW64\msiexec.exe

Code function: 5_2_000E9C90 AdjustTokenPrivileges,

5_2_000E9C90

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_003569A0 CreateToolhelp32Snapshot,GetCurrentProcessId,Thread32First,GetLastError,Thread32Next,

4_2_003569A0

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\0FDE0000

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\{6564EBFF-51EC-A92E-3E66-73D0C2BEFC46}
Source: C:\Windows\SysWOW64\msiexec.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\{451CDBFF-61EC-8956-3E66-73D0C2BEFC46}
Source: C:\Windows\SysWOW64\msiexec.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\{F5F5D963-6370-39BF-3E66-73D0C2BEFC46}

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRD171.tmp

Jump to behavior

Source: case (4335).xls

OLE indicator, Workbook stream: true

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\formnet.dll,DllRegisterServer

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: unknown	Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\formnet.dll,DllRegisterServer
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\formnet.dll,DllRegisterServer
Source: unknown	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec.exe
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\formnet.dll,DllRegisterServer	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\formnet.dll,DllRegisterServer	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec.exe	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:

Binary string: c:\PlanetAllow\OpenRoll\cellNumeral\money.pdb source: scfrd[1].dll.0.dr

Source: case (4335).xls

Initial sample: OLE summary lastprinted = 2021-01-26 16:17:13

Source: case (4335).xls

Initial sample: OLE indicators vbamacros = False

Data Obfuscation:

Contains functionality to dynamically determine API calls

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_0034D830 LoadLibraryA,GetProcAddress,

4_2_0034D830

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0036D1F2 push dword ptr [ecx]; iretd	4_2_0036D1F9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0036E9FA push esi; retf	4_2_0036EABE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0036EA51 push esi; retf	4_2_0036EABE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00369A5D push ebp; iretd	4_2_00369AEF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003682EB push eax; ret	4_2_0036834A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004093ED push ecx; ret	4_2_00409400
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0036B56F push esp; ret	4_2_0036B581
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0036B700 push ss; ret	4_2_0036B735
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00422B73 push esi; ret	4_2_00422B75

Persistence and Installation Behavior:

Drops PE files

Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Ubc\way.dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\scfrd[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\ProgramData\formnet.dll	Jump to dropped file

Drops PE files to the application program directory (C:\ProgramData)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\ProgramData\formnet.dll

Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_003569A0 CreateToolhelp32Snapshot,GetCurrentProcessId,Thread32First,GetLastError,Thread32Next,

4_2_003569A0

Found dropped PE file which has not been started or loaded

Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Ubc\way.dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\scfrd[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\ProgramData\formnet.dll	Jump to dropped file

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\SysWOW64\msiexec.exe TID: 2864

Thread sleep time: -240000s >= -30000s

Jump to behavior

Anti Debugging:

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_0040A0CC _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

4_2_0040A0CC

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_003569A0 CreateToolhelp32Snapshot,GetCurrentProcessId,Thread32First,GetLastError,Thread32Next,

4_2_003569A0

Contains functionality to dynamically determine API calls

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_0034D830 LoadLibraryA,GetProcAddress,

4_2_0034D830

Contains functionality to read the PEB

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00352EF0 mov eax, dword ptr fs:[00000030h]	4_2_00352EF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00420D28 mov eax, dword ptr fs:[00000030h]	4_2_00420D28
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00420C5E mov eax, dword ptr fs:[00000030h]	4_2_00420C5E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00420865 push dword ptr fs:[00000030h]	4_2_00420865
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_000E2EF0 mov eax, dword ptr fs:[00000030h]	5_2_000E2EF0

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0040A0CC _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		4_2_0040A0CC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0040ABA4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		4_2_0040ABA4

HIPS / PFW / Operating System Protection Evasion:

Contains functionality to inject code into remote processes

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_0034AE40 CreateProcessA,VirtualAllocEx,WriteProcessMemory,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,SetThreadContext,VirtualProtectEx,ResumeThread,ExitProcess,

4_2_0034AE40

Yara detected hidden Macro 4.0 in Excel

Source: Yara match

File source: case (4335).xls, type: SAMPLE

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\formnet.dll,DllRegisterServer			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec.exe			Jump to behavior

Source: msiexec.exe, 00000005.00000002.2356165032.0000000000A30000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: msiexec.exe, 00000005.00000002.2356165032.0000000000A30000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: msiexec.exe, 00000005.00000002.2356165032.0000000000A30000.00000002.00000001.sdmp	Binary or memory string: !Progman

Language, Device and Operating System Detection:

Contains functionality to query CPU information (cpuid)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_0040968A cpuid

4_2_0040968A

Contains functionality to query locales information (e.g. system language)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: GetLocaleInfoA,

4_2_0040F6BB

Queries the product ID of Windows

Source: C:\Windows\SysWOW64\msiexec.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_004095A6 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

4_2_004095A6

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_00341A00 CreateDialogParamW,GetVersion,

4_2_00341A00

Source: C:\Windows\SysWOW64\msiexec.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

ID:	344665
Product:	CloudBasic
Start time:	21:34:07
Start date:	26.01.2021
Sample:	case (4335).xls
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Architecture:	WINDOWS
MD5:	bf86559630b855e4bf2c54d641147b24
SHA1:	182cbac1bdd020fa5fee6ed9d6a50d1071fbe320
SHA256:	31ea3370ca06a2af45514a59a0ae49dc62ac34bc4dce44402f169a9d6fb93853
Filetype:	Microsoft Excel sheet (30009/1) 78.94%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\formnet.dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	B0F3FA047F6AE39A145FD364F693638E	1951696D8ACA4A31614BB68F9DA392402785E14E	0BF22B8F9AAEF21AFE71FCBBEA62325E7582DAD410B0A537F38A9EB8E6855890
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\scfrd[1].dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	B0F3FA047F6AE39A145FD364F693638E	1951696D8ACA4A31614BB68F9DA392402785E14E	0BF22B8F9AAEF21AFE71FCBBEA62325E7582DAD410B0A537F38A9EB8E6855890
C:\Users\user\AppData\Local\Temp\FDDE0000	data	756B1D60127951007258D72EAF5243B3	B6999B2C61B0D5F146A3A9C140B465759CF1A754	5A9CBA6603DCF58220E2076ABCC1E9889917769BAB73D24EFD54C4F17B309D1F
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Wed Jan 27 04:34:42 2021, atime=Wed Jan 27 04:34:42 2021, length=8192, window=hide	B5FA6EDF15A44D7B78F7D923AE79E0B0	DCAEEC08A30FC74C486371D75B6146FBE60BBF37	A019AD5EF24BEB3F34EEDB8F720A148C70979DC5DB441FE2DAAAA27C244D046C
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\case (4335).LNK	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:13 2020, mtime=Wed Jan 27 04:34:42 2021, atime=Wed Jan 27 04:34:42 2021, length=99328, window=hide	7D69374CC0FF7B2AF57099A2C208DC1D	EF7FFA5E9DF8BE113452FDC7CF6A6EB820A59AAF	F19BA3A3D77B50B19258FCD30A1EAB60098182727A3D74227DE9AC3C8F276429
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat	ASCII text, with CRLF line terminators	E523EBFB4AF52DD8C201A2682CB6D5C2	9E524CE9C95F9861591F955E1958970D65C76539	D9A1347100542AE0ACB17709B30B3E5A3C28AF3254914EB6EBE5504A9612DD24
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\50PT1LPA.txt	ASCII text	796C2B6962C518671977FD8F875322E4	E7C8D7EB4238DC963C999B01B640D320E5BCEE97	CE08B896C90A5D1B3697D179539F689410D6226DA4697F674E21D43C16F7E629
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\NZ5UXGF8.txt	ASCII text	E56794E70DBCEE6026450D29D29A8978	243ED8813262E2B9FC537243CCCA576CDEB0BCF6	6CF74E6DB08AE634293BD9A497F5FDE9E67F3FF25E59C01C064C93157D688F73
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\QUXL3DRG.txt	ASCII text	78C17B26331AE38E3113FF256E212001	F2BDCBEADBCF3841B9799BF831B6168F485EFF7C	FE197B665D9EE490696887F2446F278C23513AAAAA2F18422CD1375BFDAFCCAD
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Y7E8FGKZ.txt	ASCII text	7E09D3A0588D75401463087B2C0D8E09	A7B75E9770705361A32DCC13AD806D5DA3A161A3	22F797BF239CE7F7744C554EF0C1E0B6D1C21C5522EB3FDD193E1A4E75B9819C
C:\Users\user\AppData\Roaming\Ubc\way.dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	B0F3FA047F6AE39A145FD364F693638E	1951696D8ACA4A31614BB68F9DA392402785E14E	0BF22B8F9AAEF21AFE71FCBBEA62325E7582DAD410B0A537F38A9EB8E6855890
C:\Users\user\Desktop\0FDE0000	Applesoft BASIC program data, first line number 16	3FA52813F41144EBCBCB489CB2D5D8EB	BD1996F4AAE5B541C4E792DCABB2A37D7228DB65	C70F62AC6330A591042A6C85EE24BC8B83376EDC4206B4C8568CB212A900FA6D

Analysis Report case (4335).xls

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains